3. Policy recommendations

Images: Johannes Jansson / norden.org and Marie Ullnert / imagebank.sweden.se

To support effective implementation of the Gigabit Infrastructure Act alongside evolving cybersecurity obligations under the NIS2, particularly in rural and cross-border contexts, the following points should be considered to ensure alignment between connectivity goals and resilience requirements:

1. Align GIA implementation with regional governance and risk frameworks:

The GIA is not a purely technical infrastructure rollout tool – its ambitions are deeply embedded in national and regional risk management cultures and administrative capacities. This is of particular importance for rural areas and cross-border scenarios, where resource constraints and jurisdictional complexities are most pronounced. Policymakers should prioritise the harmonisation of GIA rollout with established frameworks to foster sustainable infrastructure development and effective risk mitigation.

2. Provide operational guidance on the GIA–NIS2 interplay for local authorities:

Legal uncertainties can be mitigated by offering actionable, operational-level tools. This includes not only clarifying where responsibilities sit under each directive but also providing concrete examples of how local authorities can integrate resilience requirements into connectivity planning. Showcasing good practice from early adopters, particularly in rural or cross-border areas facing similar resource and capacity constraints, can help authorities translate regulatory obligations into practical workflows.

3. Strengthen rural cybersecurity capacity through shared services and preparedness:

Rural or smaller stakeholders, such as municipalities, may be uncertain of their legal status or under-equipped to handle NIS2-level responsibilities. Addressing these vulnerabilities requires structured institutional support, including technical assistance programmes and cross-border knowledge-sharing hubs. These initiatives should focus on enhancing cybersecurity preparedness, clarifying legal responsibilities, and providing access to expert recourses.

4. Monitor and evaluate GIA–NIS2 interaction over time:

Regular impact assessments, performed by for example national and regional authorities, can evaluate how the GIA affects cybersecurity resilience over time, informing future updates and deployment strategies. Clear division of responsibility, who gathers data - who validates compliance, who follows up on identified risks - helps ensure that evaluations are not only systematic but also actionable.